CVE-2026-59875: node-tar NUL Byte Denial of Service in PAX Headers

Technical summary

CVE-2026-59875 is a denial-of-service vulnerability in node-tar versions prior to 7.5.17. The root cause is the failure to sanitize NUL bytes (\x00) from PAX (POSIX.1-2001 eXtended) header records, specifically in the path and linkpath fields handled in src/pax.ts. PAX headers are an extension mechanism within tar archives that allow metadata beyond the standard tar format. When malformed PAX records containing embedded NUL bytes are processed, they propagate unchecked into filesystem API calls (fs.lstat, fs.open), which reject the null-terminated strings and throw exceptions. The application lacks exception handling for this scenario, resulting in an unhandled exception and process termination. The vulnerability requires no authentication and exploits normal archive extraction workflows.

Business impact

Denial-of-service attacks against build pipelines, deployment automation, and package management workflows are the primary concern. Continuous integration systems that automatically extract and process tar archives (common in software distribution) become targets. An attacker can poison a dependency or supply chain artifact with a crafted tar archive, causing CI/CD failures and service disruption. While this does not expose data or grant code execution, persistent failures can delay releases and damage operational reliability. Organizations relying on automated extraction of untrusted archives face the highest risk.

Affected systems

Any Node.js application using node-tar library version prior to 7.5.17 is vulnerable. This includes indirect dependencies—applications need not directly import node-tar to be affected if it appears in the dependency tree. Package managers, build tools, container image builders, and software distribution systems that unpack tar archives are particularly common exposure points. The vulnerability does not depend on operating system or architecture; it affects all platforms running the vulnerable Node.js library.

Exploitability

Exploitation is straightforward and requires only the ability to supply a crafted tar archive to a vulnerable application. No special network privileges, authentication, or user interaction is needed. An attacker can inject a malicious tar file into supply chains, public repositories, or any distribution channel where archives are automatically extracted. The technical barrier to crafting a tar with malicious PAX headers is minimal, making this vulnerability accessible to adversaries with basic archive manipulation knowledge. The CVSS score of 5.3 (MEDIUM) reflects the availability impact limited to denial of service without confidentiality or integrity compromise.

Remediation

Immediate patching to node-tar 7.5.17 or later is the definitive remediation. The fix adds proper NUL byte stripping from PAX path and linkpath fields, preventing malformed data from reaching filesystem APIs. Organizations should audit their dependency trees to identify node-tar usage, including transitive dependencies via npm or yarn. After upgrading, applications should be restarted to load the patched library. No workarounds exist short of avoiding tar extraction from untrusted sources or implementing custom validation logic upstream.

Patch guidance

Verify your Node.js project's node-tar version via package.json or npm list. If the version is below 7.5.17, update immediately using npm update node-tar or yarn upgrade node-tar. For projects using lock files (package-lock.json or yarn.lock), regenerate these to ensure consistent patched versions across environments. Test the updated library in a staging environment before production rollout, particularly for CI/CD pipelines and automated extraction workflows. Verify against the official node-tar release notes and GitHub repository to confirm the patch version addresses CVE-2026-59875.

Detection guidance

Monitor for unhandled exceptions or uncaught errors in Node.js applications during tar archive processing, particularly crashes with stack traces referencing fs.lstat or fs.open from node-tar code paths. Review CI/CD logs for unexpected pipeline failures coinciding with archive extraction steps. Implement input validation on tar files prior to extraction—validate the integrity of PAX headers or reject archives with suspicious metadata. Network-level detection is difficult without deep inspection; focus on application-layer logging and alerting for abnormal tar processing behavior. Organizations handling untrusted archives should instrument their extraction workflows with enhanced logging.

Why prioritize this

While CVSS 5.3 indicates medium severity, prioritization should account for deployment context. Build automation and supply chain components warrant faster patching due to the ease of weaponizing crafted archives at scale. Public-facing services that accept user-uploaded tar files should be prioritized. Internal services with tightly controlled archive sources face lower immediate risk but should still patch within standard update cycles. The lack of KEV status suggests limited active exploitation in the wild currently, but the simplicity of attack makes this a proactive hardening priority rather than an emergency.

Risk score, explained

The CVSS 5.3 score reflects a network-accessible vulnerability with low attack complexity and no authentication, but limited impact scope (availability only—no data disclosure or privilege escalation). The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L assigns moderate weight because availability impact is restricted to the affected application process. The score would be elevated if the vulnerability enabled remote code execution, privilege escalation, or data exfiltration. In contexts where service availability is critical (SLAs, production infrastructure), risk perception may exceed the numerical score.

Frequently asked questions